1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/enumerate_modules_model_win.h"
6
7#include <Tlhelp32.h>
8#include <wintrust.h>
9#include <algorithm>
10
11#include "base/bind.h"
12#include "base/command_line.h"
13#include "base/environment.h"
14#include "base/file_version_info_win.h"
15#include "base/files/file_path.h"
16#include "base/i18n/case_conversion.h"
17#include "base/metrics/histogram.h"
18#include "base/strings/string_number_conversions.h"
19#include "base/strings/string_util.h"
20#include "base/strings/utf_string_conversions.h"
21#include "base/time/time.h"
22#include "base/values.h"
23#include "base/version.h"
24#include "base/win/registry.h"
25#include "base/win/scoped_handle.h"
26#include "base/win/windows_version.h"
27#include "chrome/browser/chrome_notification_types.h"
28#include "chrome/browser/net/service_providers_win.h"
29#include "chrome/common/chrome_constants.h"
30#include "chrome/grit/generated_resources.h"
31#include "content/public/browser/notification_service.h"
32#include "crypto/sha2.h"
33#include "ui/base/l10n/l10n_util.h"
34
35using content::BrowserThread;
36
37// The period of time (in milliseconds) to wait until checking to see if any
38// incompatible modules exist.
39static const int kModuleCheckDelayMs = 45 * 1000;
40
41// The path to the Shell Extension key in the Windows registry.
42static const wchar_t kRegPath[] =
43    L"Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved";
44
45// Short-hand for things on the blacklist you should simply get rid of.
46static const ModuleEnumerator::RecommendedAction kUninstallLink =
47    static_cast<ModuleEnumerator::RecommendedAction>(
48        ModuleEnumerator::UNINSTALL | ModuleEnumerator::SEE_LINK);
49
50// Short-hand for things on the blacklist we are investigating and have info.
51static const ModuleEnumerator::RecommendedAction kInvestigatingLink =
52    static_cast<ModuleEnumerator::RecommendedAction>(
53        ModuleEnumerator::INVESTIGATING | ModuleEnumerator::SEE_LINK);
54
55// A sort method that sorts by bad modules first, then by full name (including
56// path).
57static bool ModuleSort(const ModuleEnumerator::Module& a,
58                       const ModuleEnumerator::Module& b) {
59  if (a.status != b.status)
60    return a.status > b.status;
61
62  if (a.location == b.location)
63    return a.name < b.name;
64
65  return a.location < b.location;
66}
67
68namespace {
69
70// Used to protect the LoadedModuleVector which is accessed
71// from both the UI thread and the FILE thread.
72base::Lock* lock = NULL;
73
74// A struct to help de-duping modules before adding them to the enumerated
75// modules vector.
76struct FindModule {
77 public:
78  explicit FindModule(const ModuleEnumerator::Module& x)
79    : module(x) {}
80  bool operator()(const ModuleEnumerator::Module& module_in) const {
81    return (module.location == module_in.location) &&
82           (module.name == module_in.name);
83  }
84
85  const ModuleEnumerator::Module& module;
86};
87
88// Returns the long path name given a short path name. A short path name is a
89// path that follows the 8.3 convention and has ~x in it. If the path is already
90// a long path name, the function returns the current path without modification.
91bool ConvertToLongPath(const base::string16& short_path,
92                       base::string16* long_path) {
93  wchar_t long_path_buf[MAX_PATH];
94  DWORD return_value = GetLongPathName(short_path.c_str(), long_path_buf,
95                                       MAX_PATH);
96  if (return_value != 0 && return_value < MAX_PATH) {
97    *long_path = long_path_buf;
98    return true;
99  }
100
101  return false;
102}
103
104}  // namespace
105
106// The browser process module blacklist. This lists modules that are known
107// to cause compatibility issues within the browser process. When adding to this
108// list, make sure that all paths are lower-case, in long pathname form, end
109// with a slash and use environments variables (or just look at one of the
110// comments below and keep it consistent with that). When adding an entry with
111// an environment variable not currently used in the list below, make sure to
112// update the list in PreparePathMappings. Filename, Description/Signer, and
113// Location must be entered as hashes (see GenerateHash). Filename is mandatory.
114// Entries without any Description, Signer info, or Location will never be
115// marked as confirmed bad (only as suspicious).
116const ModuleEnumerator::BlacklistEntry ModuleEnumerator::kModuleBlacklist[] = {
117  // NOTE: Please keep this list sorted by dll name, then location.
118
119  // Version 3.2.1.6 seems to be implicated in most cases (and 3.2.2.2 in some).
120  // There is a more recent version available for download.
121  // accelerator.dll, "%programfiles%\\speedbit video accelerator\\".
122  { "7ba9402f", "c9132d48", "", "", "", ALL, kInvestigatingLink },
123
124  // apiqq0.dll, "%temp%\\".
125  { "26134911", "59145acf", "", "", "", ALL, kUninstallLink },
126
127  // arking0.dll, "%systemroot%\\system32\\".
128  { "f5d8f549", "23d01d5b", "", "", "", ALL, kUninstallLink },
129
130  // arking1.dll, "%systemroot%\\system32\\".
131  { "c60ca062", "23d01d5b", "", "", "", ALL, kUninstallLink },
132
133  // aswjsflt.dll, "%ProgramFiles%\\avast software\\avast\\", "AVAST Software".
134  // NOTE: The digital signature of the DLL is double null terminated.
135  // Avast Antivirus prior to version 8.0 would kill the Chrome child process
136  // when blocked from running.
137  { "2ea5422a", "6b3a1b00", "a7db0e0c", "", "8.0", XP,
138    static_cast<RecommendedAction>(UPDATE | SEE_LINK | NOTIFY_USER) },
139
140  // aswjsflt.dll, "%ProgramFiles%\\alwil software\\avast5\\", "AVAST Software".
141  // NOTE: The digital signature of the DLL is double null terminated.
142  // Avast Antivirus prior to version 8.0 would kill the Chrome child process
143  // when blocked from running.
144  { "2ea5422a", "d8686924", "a7db0e0c", "", "8.0", XP,
145    static_cast<RecommendedAction>(UPDATE | SEE_LINK | NOTIFY_USER) },
146
147  // Said to belong to Killer NIC from BigFoot Networks (not verified). Versions
148  // 6.0.0.7 and 6.0.0.10 implicated.
149  // bfllr.dll, "%systemroot%\\system32\\".
150  { "6bb57633", "23d01d5b", "", "", "", ALL, kInvestigatingLink },
151
152  // clickpotatolitesahook.dll, "". Different version each report.
153  { "0396e037.dll", "", "", "", "", ALL, kUninstallLink },
154
155  // cvasds0.dll, "%temp%\\".
156  { "5ce0037c", "59145acf", "", "", "", ALL, kUninstallLink },
157
158  // cwalsp.dll, "%systemroot%\\system32\\".
159  { "e579a039", "23d01d5b", "", "", "", ALL, kUninstallLink },
160
161  // datamngr.dll (1), "%programfiles%\\searchqu toolbar\\datamngr\\".
162  { "7add320b", "470a3da3", "", "", "", ALL, kUninstallLink },
163
164  // datamngr.dll (2), "%programfiles%\\windows searchqu toolbar\\".
165  { "7add320b", "7a3c8be3", "", "", "", ALL, kUninstallLink },
166
167  // dsoqq0.dll, "%temp%\\".
168  { "1c4df325", "59145acf", "", "", "", ALL, kUninstallLink },
169
170  // flt.dll, "%programfiles%\\tueagles\\".
171  { "6d01f4a1", "7935e9c2", "", "", "", ALL, kUninstallLink },
172
173  // This looks like a malware edition of a Brazilian Bank plugin, sometimes
174  // referred to as Malware.Banc.A.
175  // gbieh.dll, "%programfiles%\\gbplugin\\".
176  { "4cb4f2e3", "88e4a3b1", "", "", "", ALL, kUninstallLink },
177
178  // hblitesahook.dll. Each report has different version number in location.
179  { "5d10b363", "", "", "", "", ALL, kUninstallLink },
180
181  // icf.dll, "%systemroot%\\system32\\".
182  { "303825ed", "23d01d5b", "", "", "", ALL, INVESTIGATING },
183
184  // idmmbc.dll (IDM), "%systemroot%\\system32\\". See: http://crbug.com/26892/.
185  { "b8dce5c3", "23d01d5b", "", "", "6.03", ALL,
186      static_cast<RecommendedAction>(UPDATE | DISABLE) },
187
188  // imon.dll (NOD32), "%systemroot%\\system32\\". See: http://crbug.com/21715.
189  { "8f42f22e", "23d01d5b", "", "", "4.0", ALL,
190      static_cast<RecommendedAction>(UPDATE | DISABLE) },
191
192  // is3lsp.dll, "%commonprogramfiles%\\is3\\anti-spyware\\".
193  { "7ffbdce9", "bc5673f2", "", "", "", ALL,
194      static_cast<RecommendedAction>(UPDATE | DISABLE | SEE_LINK) },
195
196  // jsi.dll, "%programfiles%\\profilecraze\\".
197  { "f9555eea", "e3548061", "", "", "", ALL, kUninstallLink },
198
199  // kernel.dll, "%programfiles%\\contentwatch\\internet protection\\modules\\".
200  { "ead2768e", "4e61ce60", "", "", "", ALL, INVESTIGATING },
201
202  // mgking0.dll, "%systemroot%\\system32\\".
203  { "d0893e38", "23d01d5b", "", "", "", ALL, kUninstallLink },
204
205  // mgking0.dll, "%temp%\\".
206  { "d0893e38", "59145acf", "", "", "", ALL, kUninstallLink },
207
208  // mgking1.dll, "%systemroot%\\system32\\".
209  { "3e837222", "23d01d5b", "", "", "", ALL, kUninstallLink },
210
211  // mgking1.dll, "%temp%\\".
212  { "3e837222", "59145acf", "", "", "", ALL, kUninstallLink },
213
214  // mstcipha.ime, "%systemroot%\\system32\\".
215  { "5523579e", "23d01d5b", "", "", "", ALL, INVESTIGATING },
216
217  // mwtsp.dll, "%systemroot%\\system32\\".
218  { "9830bff6", "23d01d5b", "", "", "", ALL, kUninstallLink },
219
220  // nodqq0.dll, "%temp%\\".
221  { "b86ce04d", "59145acf", "", "", "", ALL, kUninstallLink },
222
223  // nProtect GameGuard Anti-cheat system. Every report has a different
224  // location, since it is installed into and run from a game folder. Various
225  // versions implicated.
226  // npggnt.des, no fixed location.
227  { "f2c8790d", "", "", "", "", ALL, kInvestigatingLink },
228
229  // nvlsp.dll,
230  // "%programfiles%\\nvidia corporation\\networkaccessmanager\\bin32\\".
231  { "37f907e2", "3ad0ff23", "", "", "", ALL, INVESTIGATING },
232
233  // post0.dll, "%systemroot%\\system32\\".
234  { "7405c0c8", "23d01d5b", "", "", "", ALL, kUninstallLink },
235
236  // questbrwsearch.dll, "%programfiles%\\questbrwsearch\\".
237  { "0953ed09", "f0d5eeda", "", "", "", ALL, kUninstallLink },
238
239  // questscan.dll, "%programfiles%\\questscan\\".
240  { "f4f3391e", "119d20f7", "", "", "", ALL, kUninstallLink },
241
242  // radhslib.dll (Naomi web filter), "%programfiles%\\rnamfler\\".
243  // See http://crbug.com/12517.
244  { "7edcd250", "0733dc3e", "", "", "", ALL, INVESTIGATING },
245
246  // rlls.dll, "%programfiles%\\relevantknowledge\\".
247  { "a1ed94a7", "ea9d6b36", "", "", "", ALL, kUninstallLink },
248
249  // rooksdol.dll, "%programfiles%\\trusteer\\rapport\\bin\\".
250  { "802aefef", "06120e13", "", "", "3.5.1008.40", ALL, UPDATE },
251
252  // scanquery.dll, "%programfiles%\\scanquery\\".
253  { "0b52d2ae", "a4cc88b1", "", "", "", ALL, kUninstallLink },
254
255  // sdata.dll, "%programdata%\\srtserv\\".
256  { "1936d5cc", "223c44be", "", "", "", ALL, kUninstallLink },
257
258  // searchtree.dll,
259  // "%programfiles%\\contentwatch\\internet protection\\modules\\".
260  { "f6915a31", "4e61ce60", "", "", "", ALL, INVESTIGATING },
261
262  // sgprxy.dll, "%commonprogramfiles%\\is3\\anti-spyware\\".
263  { "005965ea", "bc5673f2", "", "", "", ALL, INVESTIGATING },
264
265  // snxhk.dll, "%ProgramFiles%\\avast software\\avast\\", "AVAST Software".
266  // NOTE: The digital signature of the DLL is double null terminated.
267  // Avast Antivirus prior to version 8.0 would kill the Chrome child process
268  // when blocked from running.
269  { "46c16aa8", "6b3a1b00", "a7db0e0c", "", "8.0", XP,
270    static_cast<RecommendedAction>(UPDATE | SEE_LINK | NOTIFY_USER) },
271
272  // snxhk.dll, "%ProgramFiles%\\alwil software\\avast5\\", "AVAST Software".
273  // NOTE: The digital signature of the DLL is double null terminated.
274  // Avast Antivirus prior to version 8.0 would kill the Chrome child process
275  // when blocked from running.
276  { "46c16aa8", "d8686924", "a7db0e0c", "", "8.0", XP,
277    static_cast<RecommendedAction>(UPDATE | SEE_LINK | NOTIFY_USER) },
278
279  // sprotector.dll, "". Different location each report.
280  { "24555d74", "", "", "", "", ALL, kUninstallLink },
281
282  // swi_filter_0001.dll (Sophos Web Intelligence),
283  // "%programfiles%\\sophos\\sophos anti-virus\\web intelligence\\".
284  // A small random sample all showed version 1.0.5.0.
285  { "61112d7b", "25fb120f", "", "", "", ALL, kInvestigatingLink },
286
287  // twking0.dll, "%systemroot%\\system32\\".
288  { "0355549b", "23d01d5b", "", "", "", ALL, kUninstallLink },
289
290  // twking1.dll, "%systemroot%\\system32\\".
291  { "02e44508", "23d01d5b", "", "", "", ALL, kUninstallLink },
292
293  // vksaver.dll, "%systemroot%\\system32\\".
294  { "c4a784d5", "23d01d5b", "", "", "", ALL, kUninstallLink },
295
296  // vlsp.dll (Venturi Firewall?), "%systemroot%\\system32\\".
297  { "2e4eb93d", "23d01d5b", "", "", "", ALL, INVESTIGATING },
298
299  // vmn3_1dn.dll, "%appdata%\\roaming\\vmndtxtb\\".
300  { "bba2037d", "9ab68585", "", "", "", ALL, kUninstallLink },
301
302  // webanalyzer.dll,
303  // "%programfiles%\\contentwatch\\internet protection\\modules\\".
304  { "c70b697d", "4e61ce60", "", "", "", ALL, INVESTIGATING },
305
306  // wowst0.dll, "%systemroot%\\system32\\".
307  { "38ad9963", "23d01d5b", "", "", "", ALL, kUninstallLink },
308
309  // wxbase28u_vc_cw.dll, "%systemroot%\\system32\\".
310  { "e967210d", "23d01d5b", "", "", "", ALL, kUninstallLink },
311};
312
313// Generates an 8 digit hash from the input given.
314static void GenerateHash(const std::string& input, std::string* output) {
315  if (input.empty()) {
316    *output = "";
317    return;
318  }
319
320  uint8 hash[4];
321  crypto::SHA256HashString(input, hash, sizeof(hash));
322  *output = base::StringToLowerASCII(base::HexEncode(hash, sizeof(hash)));
323}
324
325// -----------------------------------------------------------------------------
326
327// static
328void ModuleEnumerator::NormalizeModule(Module* module) {
329  base::string16 path = module->location;
330  if (!ConvertToLongPath(path, &module->location))
331    module->location = path;
332
333  module->location = base::i18n::ToLower(module->location);
334
335  // Location contains the filename, so the last slash is where the path
336  // ends.
337  size_t last_slash = module->location.find_last_of(L"\\");
338  if (last_slash != base::string16::npos) {
339    module->name = module->location.substr(last_slash + 1);
340    module->location = module->location.substr(0, last_slash + 1);
341  } else {
342    module->name = module->location;
343    module->location.clear();
344  }
345
346  // Some version strings have things like (win7_rtm.090713-1255) appended
347  // to them. Remove that.
348  size_t first_space = module->version.find_first_of(L" ");
349  if (first_space != base::string16::npos)
350    module->version = module->version.substr(0, first_space);
351
352  module->normalized = true;
353}
354
355// static
356ModuleEnumerator::ModuleStatus ModuleEnumerator::Match(
357    const ModuleEnumerator::Module& module,
358    const ModuleEnumerator::BlacklistEntry& blacklisted) {
359  // All modules must be normalized before matching against blacklist.
360  DCHECK(module.normalized);
361  // Filename is mandatory and version should not contain spaces.
362  DCHECK(strlen(blacklisted.filename) > 0);
363  DCHECK(!strstr(blacklisted.version_from, " "));
364  DCHECK(!strstr(blacklisted.version_to, " "));
365
366  base::win::Version version = base::win::GetVersion();
367  switch (version) {
368     case base::win::VERSION_XP:
369      if (!(blacklisted.os & XP)) return NOT_MATCHED;
370      break;
371    default:
372      break;
373  }
374
375  std::string filename_hash, location_hash;
376  GenerateHash(base::WideToUTF8(module.name), &filename_hash);
377  GenerateHash(base::WideToUTF8(module.location), &location_hash);
378
379  // Filenames are mandatory. Location is mandatory if given.
380  if (filename_hash == blacklisted.filename &&
381          (std::string(blacklisted.location).empty() ||
382          location_hash == blacklisted.location)) {
383    // We have a name match against the blacklist (and possibly location match
384    // also), so check version.
385    Version module_version(base::UTF16ToASCII(module.version));
386    Version version_min(blacklisted.version_from);
387    Version version_max(blacklisted.version_to);
388    bool version_ok = !version_min.IsValid() && !version_max.IsValid();
389    if (!version_ok) {
390      bool too_low = version_min.IsValid() &&
391          (!module_version.IsValid() ||
392          module_version.CompareTo(version_min) < 0);
393      bool too_high = version_max.IsValid() &&
394          (!module_version.IsValid() ||
395          module_version.CompareTo(version_max) >= 0);
396      version_ok = !too_low && !too_high;
397    }
398
399    if (version_ok) {
400      // At this point, the names match and there is no version specified
401      // or the versions also match.
402
403      std::string desc_or_signer(blacklisted.desc_or_signer);
404      std::string signer_hash, description_hash;
405      GenerateHash(base::WideToUTF8(module.digital_signer), &signer_hash);
406      GenerateHash(base::WideToUTF8(module.description), &description_hash);
407
408      // If signatures match (or both are empty), then we have a winner.
409      if (signer_hash == desc_or_signer)
410        return CONFIRMED_BAD;
411
412      // If descriptions match (or both are empty) and the locations match, then
413      // we also have a confirmed match.
414      if (description_hash == desc_or_signer &&
415          !location_hash.empty() && location_hash == blacklisted.location)
416        return CONFIRMED_BAD;
417
418      // We are not sure, but it is likely bad.
419      return SUSPECTED_BAD;
420    }
421  }
422
423  return NOT_MATCHED;
424}
425
426ModuleEnumerator::ModuleEnumerator(EnumerateModulesModel* observer)
427    : enumerated_modules_(NULL),
428      observer_(observer),
429      limited_mode_(false),
430      callback_thread_id_(BrowserThread::ID_COUNT) {
431}
432
433ModuleEnumerator::~ModuleEnumerator() {
434}
435
436void ModuleEnumerator::ScanNow(ModulesVector* list, bool limited_mode) {
437  enumerated_modules_ = list;
438
439  limited_mode_ = limited_mode;
440
441  if (!limited_mode_) {
442    CHECK(BrowserThread::GetCurrentThreadIdentifier(&callback_thread_id_));
443    BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
444                            base::Bind(&ModuleEnumerator::ScanImpl, this));
445  } else {
446    // Run it synchronously.
447    ScanImpl();
448  }
449}
450
451void ModuleEnumerator::ScanImpl() {
452  base::TimeTicks start_time = base::TimeTicks::Now();
453
454  enumerated_modules_->clear();
455
456  // Make sure the path mapping vector is setup so we can collapse paths.
457  PreparePathMappings();
458
459  // Enumerating loaded modules must happen first since the other types of
460  // modules check for duplication against the loaded modules.
461  base::TimeTicks checkpoint = base::TimeTicks::Now();
462  EnumerateLoadedModules();
463  base::TimeTicks checkpoint2 = base::TimeTicks::Now();
464  UMA_HISTOGRAM_TIMES("Conflicts.EnumerateLoadedModules",
465                      checkpoint2 - checkpoint);
466
467  checkpoint = checkpoint2;
468  EnumerateShellExtensions();
469  checkpoint2 = base::TimeTicks::Now();
470  UMA_HISTOGRAM_TIMES("Conflicts.EnumerateShellExtensions",
471                      checkpoint2 - checkpoint);
472
473  checkpoint = checkpoint2;
474  EnumerateWinsockModules();
475  checkpoint2 = base::TimeTicks::Now();
476  UMA_HISTOGRAM_TIMES("Conflicts.EnumerateWinsockModules",
477                      checkpoint2 - checkpoint);
478
479  MatchAgainstBlacklist();
480
481  std::sort(enumerated_modules_->begin(),
482            enumerated_modules_->end(), ModuleSort);
483
484  if (!limited_mode_) {
485    // Send a reply back on the UI thread.
486    BrowserThread::PostTask(callback_thread_id_, FROM_HERE,
487                            base::Bind(&ModuleEnumerator::ReportBack, this));
488  } else {
489    // We are on the main thread already.
490    ReportBack();
491  }
492
493  UMA_HISTOGRAM_TIMES("Conflicts.EnumerationTotalTime",
494                      base::TimeTicks::Now() - start_time);
495}
496
497void ModuleEnumerator::EnumerateLoadedModules() {
498  // Get all modules in the current process.
499  base::win::ScopedHandle snap(::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,
500                               ::GetCurrentProcessId()));
501  if (!snap.Get())
502    return;
503
504  // Walk the module list.
505  MODULEENTRY32 module = { sizeof(module) };
506  if (!::Module32First(snap.Get(), &module))
507    return;
508
509  do {
510    // It would be weird to present chrome.exe as a loaded module.
511    if (_wcsicmp(chrome::kBrowserProcessExecutableName, module.szModule) == 0)
512      continue;
513
514    Module entry;
515    entry.type = LOADED_MODULE;
516    entry.location = module.szExePath;
517    PopulateModuleInformation(&entry);
518
519    NormalizeModule(&entry);
520    CollapsePath(&entry);
521    enumerated_modules_->push_back(entry);
522  } while (::Module32Next(snap.Get(), &module));
523}
524
525void ModuleEnumerator::EnumerateShellExtensions() {
526  ReadShellExtensions(HKEY_LOCAL_MACHINE);
527  ReadShellExtensions(HKEY_CURRENT_USER);
528}
529
530void ModuleEnumerator::ReadShellExtensions(HKEY parent) {
531  base::win::RegistryValueIterator registration(parent, kRegPath);
532  while (registration.Valid()) {
533    std::wstring key(std::wstring(L"CLSID\\") + registration.Name() +
534        L"\\InProcServer32");
535    base::win::RegKey clsid;
536    if (clsid.Open(HKEY_CLASSES_ROOT, key.c_str(), KEY_READ) != ERROR_SUCCESS) {
537      ++registration;
538      continue;
539    }
540    base::string16 dll;
541    if (clsid.ReadValue(L"", &dll) != ERROR_SUCCESS) {
542      ++registration;
543      continue;
544    }
545    clsid.Close();
546
547    Module entry;
548    entry.type = SHELL_EXTENSION;
549    entry.location = dll;
550    PopulateModuleInformation(&entry);
551
552    NormalizeModule(&entry);
553    CollapsePath(&entry);
554    AddToListWithoutDuplicating(entry);
555
556    ++registration;
557  }
558}
559
560void ModuleEnumerator::EnumerateWinsockModules() {
561  // Add to this list the Winsock LSP DLLs.
562  WinsockLayeredServiceProviderList layered_providers;
563  GetWinsockLayeredServiceProviders(&layered_providers);
564  for (size_t i = 0; i < layered_providers.size(); ++i) {
565    Module entry;
566    entry.type = WINSOCK_MODULE_REGISTRATION;
567    entry.status = NOT_MATCHED;
568    entry.normalized = false;
569    entry.location = layered_providers[i].path;
570    entry.description = layered_providers[i].name;
571    entry.recommended_action = NONE;
572    entry.duplicate_count = 0;
573
574    wchar_t expanded[MAX_PATH];
575    DWORD size = ExpandEnvironmentStrings(
576        entry.location.c_str(), expanded, MAX_PATH);
577    if (size != 0 && size <= MAX_PATH) {
578      entry.digital_signer =
579          GetSubjectNameFromDigitalSignature(base::FilePath(expanded));
580    }
581    entry.version = base::IntToString16(layered_providers[i].version);
582
583    // Paths have already been collapsed.
584    NormalizeModule(&entry);
585    AddToListWithoutDuplicating(entry);
586  }
587}
588
589void ModuleEnumerator::PopulateModuleInformation(Module* module) {
590  module->status = NOT_MATCHED;
591  module->duplicate_count = 0;
592  module->normalized = false;
593  module->digital_signer =
594      GetSubjectNameFromDigitalSignature(base::FilePath(module->location));
595  module->recommended_action = NONE;
596  scoped_ptr<FileVersionInfo> version_info(
597      FileVersionInfo::CreateFileVersionInfo(base::FilePath(module->location)));
598  if (version_info.get()) {
599    FileVersionInfoWin* version_info_win =
600        static_cast<FileVersionInfoWin*>(version_info.get());
601
602    VS_FIXEDFILEINFO* fixed_file_info = version_info_win->fixed_file_info();
603    if (fixed_file_info) {
604      module->description = version_info_win->file_description();
605      module->version = version_info_win->file_version();
606      module->product_name = version_info_win->product_name();
607    }
608  }
609}
610
611void ModuleEnumerator::AddToListWithoutDuplicating(const Module& module) {
612  DCHECK(module.normalized);
613  // These are registered modules, not loaded modules so the same module
614  // can be registered multiple times, often dozens of times. There is no need
615  // to list each registration, so we just increment the count for each module
616  // that is counted multiple times.
617  ModulesVector::iterator iter;
618  iter = std::find_if(enumerated_modules_->begin(),
619                      enumerated_modules_->end(),
620                      FindModule(module));
621  if (iter != enumerated_modules_->end()) {
622    iter->duplicate_count++;
623    iter->type = static_cast<ModuleType>(iter->type | module.type);
624  } else {
625    enumerated_modules_->push_back(module);
626  }
627}
628
629void ModuleEnumerator::PreparePathMappings() {
630  path_mapping_.clear();
631
632  scoped_ptr<base::Environment> environment(base::Environment::Create());
633  std::vector<base::string16> env_vars;
634  env_vars.push_back(L"LOCALAPPDATA");
635  env_vars.push_back(L"ProgramFiles");
636  env_vars.push_back(L"ProgramData");
637  env_vars.push_back(L"USERPROFILE");
638  env_vars.push_back(L"SystemRoot");
639  env_vars.push_back(L"TEMP");
640  env_vars.push_back(L"TMP");
641  env_vars.push_back(L"CommonProgramFiles");
642  for (std::vector<base::string16>::const_iterator variable = env_vars.begin();
643       variable != env_vars.end(); ++variable) {
644    std::string path;
645    if (environment->GetVar(base::UTF16ToASCII(*variable).c_str(), &path)) {
646      path_mapping_.push_back(
647          std::make_pair(base::i18n::ToLower(base::UTF8ToUTF16(path)) + L"\\",
648                         L"%" + base::i18n::ToLower(*variable) + L"%"));
649    }
650  }
651}
652
653void ModuleEnumerator::CollapsePath(Module* entry) {
654  // Take the path and see if we can use any of the substitution values
655  // from the vector constructed above to replace c:\windows with, for
656  // example, %systemroot%. The most collapsed path (the one with the
657  // minimum length) wins.
658  size_t min_length = MAXINT;
659  base::string16 location = entry->location;
660  for (PathMapping::const_iterator mapping = path_mapping_.begin();
661       mapping != path_mapping_.end(); ++mapping) {
662    base::string16 prefix = mapping->first;
663    if (StartsWith(location, prefix, false)) {
664      base::string16 new_location = mapping->second +
665                              location.substr(prefix.length() - 1);
666      size_t length = new_location.length() - mapping->second.length();
667      if (length < min_length) {
668        entry->location = new_location;
669        min_length = length;
670      }
671    }
672  }
673}
674
675void ModuleEnumerator::MatchAgainstBlacklist() {
676  for (size_t m = 0; m < enumerated_modules_->size(); ++m) {
677    // Match this module against the blacklist.
678    Module* module = &(*enumerated_modules_)[m];
679    module->status = GOOD;  // We change this below potentially.
680    for (size_t i = 0; i < arraysize(kModuleBlacklist); ++i) {
681      #if !defined(NDEBUG)
682        // This saves time when constructing the blacklist.
683        std::string hashes(kModuleBlacklist[i].filename);
684        std::string hash1, hash2, hash3;
685        GenerateHash(kModuleBlacklist[i].filename, &hash1);
686        hashes += " - " + hash1;
687        GenerateHash(kModuleBlacklist[i].location, &hash2);
688        hashes += " - " + hash2;
689        GenerateHash(kModuleBlacklist[i].desc_or_signer, &hash3);
690        hashes += " - " + hash3;
691      #endif
692
693      ModuleStatus status = Match(*module, kModuleBlacklist[i]);
694      if (status != NOT_MATCHED) {
695        // We have a match against the blacklist. Mark it as such.
696        module->status = status;
697        module->recommended_action = kModuleBlacklist[i].help_tip;
698        break;
699      }
700    }
701
702    // Modules loaded from these locations are frequently malicious
703    // and notorious for changing frequently so they are not good candidates
704    // for blacklisting individually. Mark them as suspicious if we haven't
705    // classified them as bad yet.
706    if (module->status == NOT_MATCHED || module->status == GOOD) {
707      if (StartsWith(module->location, L"%temp%", false) ||
708          StartsWith(module->location, L"%tmp%", false)) {
709        module->status = SUSPECTED_BAD;
710      }
711    }
712  }
713}
714
715void ModuleEnumerator::ReportBack() {
716  if (!limited_mode_)
717    DCHECK(BrowserThread::CurrentlyOn(callback_thread_id_));
718  observer_->DoneScanning();
719}
720
721base::string16 ModuleEnumerator::GetSubjectNameFromDigitalSignature(
722    const base::FilePath& filename) {
723  HCERTSTORE store = NULL;
724  HCRYPTMSG message = NULL;
725
726  // Find the crypto message for this filename.
727  bool result = !!CryptQueryObject(CERT_QUERY_OBJECT_FILE,
728                                   filename.value().c_str(),
729                                   CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED,
730                                   CERT_QUERY_FORMAT_FLAG_BINARY,
731                                   0,
732                                   NULL,
733                                   NULL,
734                                   NULL,
735                                   &store,
736                                   &message,
737                                   NULL);
738  if (!result)
739    return base::string16();
740
741  // Determine the size of the signer info data.
742  DWORD signer_info_size = 0;
743  result = !!CryptMsgGetParam(message,
744                              CMSG_SIGNER_INFO_PARAM,
745                              0,
746                              NULL,
747                              &signer_info_size);
748  if (!result)
749    return base::string16();
750
751  // Allocate enough space to hold the signer info.
752  scoped_ptr<BYTE[]> signer_info_buffer(new BYTE[signer_info_size]);
753  CMSG_SIGNER_INFO* signer_info =
754      reinterpret_cast<CMSG_SIGNER_INFO*>(signer_info_buffer.get());
755
756  // Obtain the signer info.
757  result = !!CryptMsgGetParam(message,
758                              CMSG_SIGNER_INFO_PARAM,
759                              0,
760                              signer_info,
761                              &signer_info_size);
762  if (!result)
763    return base::string16();
764
765  // Search for the signer certificate.
766  CERT_INFO CertInfo = {0};
767  PCCERT_CONTEXT cert_context = NULL;
768  CertInfo.Issuer = signer_info->Issuer;
769  CertInfo.SerialNumber = signer_info->SerialNumber;
770
771  cert_context = CertFindCertificateInStore(
772      store,
773      X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
774      0,
775      CERT_FIND_SUBJECT_CERT,
776      &CertInfo,
777      NULL);
778  if (!cert_context)
779    return base::string16();
780
781  // Determine the size of the Subject name.
782  DWORD subject_name_size = CertGetNameString(
783      cert_context, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, NULL, NULL, 0);
784  if (!subject_name_size)
785    return base::string16();
786
787  base::string16 subject_name;
788  subject_name.resize(subject_name_size);
789
790  // Get subject name.
791  if (!(CertGetNameString(cert_context,
792                          CERT_NAME_SIMPLE_DISPLAY_TYPE,
793                          0,
794                          NULL,
795                          const_cast<LPWSTR>(subject_name.c_str()),
796                          subject_name_size))) {
797    return base::string16();
798  }
799
800  return subject_name;
801}
802
803//  ----------------------------------------------------------------------------
804
805// static
806EnumerateModulesModel* EnumerateModulesModel::GetInstance() {
807  return Singleton<EnumerateModulesModel>::get();
808}
809
810bool EnumerateModulesModel::ShouldShowConflictWarning() const {
811  // If the user has acknowledged the conflict notification, then we don't need
812  // to show it again (because the scanning only happens once per the lifetime
813  // of the process). If we were to run the scanning more than once, then we'd
814  // need to clear the flag somewhere when we are ready to show it again.
815  if (conflict_notification_acknowledged_)
816    return false;
817
818  return confirmed_bad_modules_detected_ > 0;
819}
820
821void EnumerateModulesModel::AcknowledgeConflictNotification() {
822  if (!conflict_notification_acknowledged_) {
823    conflict_notification_acknowledged_ = true;
824    content::NotificationService::current()->Notify(
825        chrome::NOTIFICATION_MODULE_INCOMPATIBILITY_BADGE_CHANGE,
826        content::Source<EnumerateModulesModel>(this),
827        content::NotificationService::NoDetails());
828  }
829}
830
831void EnumerateModulesModel::ScanNow() {
832  if (scanning_)
833    return;  // A scan is already in progress.
834
835  lock->Acquire();  // Balanced in DoneScanning();
836
837  scanning_ = true;
838
839  // Instruct the ModuleEnumerator class to load this on the File thread.
840  // ScanNow does not block.
841  if (!module_enumerator_)
842    module_enumerator_ = new ModuleEnumerator(this);
843  module_enumerator_->ScanNow(&enumerated_modules_, limited_mode_);
844}
845
846base::ListValue* EnumerateModulesModel::GetModuleList() const {
847  if (scanning_)
848    return NULL;
849
850  lock->Acquire();
851
852  if (enumerated_modules_.empty()) {
853    lock->Release();
854    return NULL;
855  }
856
857  base::ListValue* list = new base::ListValue();
858
859  for (ModuleEnumerator::ModulesVector::const_iterator module =
860           enumerated_modules_.begin();
861       module != enumerated_modules_.end(); ++module) {
862    base::DictionaryValue* data = new base::DictionaryValue();
863    data->SetInteger("type", module->type);
864    base::string16 type_string;
865    if ((module->type & ModuleEnumerator::LOADED_MODULE) == 0) {
866      // Module is not loaded, denote type of module.
867      if (module->type & ModuleEnumerator::SHELL_EXTENSION)
868        type_string = base::ASCIIToWide("Shell Extension");
869      if (module->type & ModuleEnumerator::WINSOCK_MODULE_REGISTRATION) {
870        if (!type_string.empty())
871          type_string += base::ASCIIToWide(", ");
872        type_string += base::ASCIIToWide("Winsock");
873      }
874      // Must be one of the above type.
875      DCHECK(!type_string.empty());
876      if (!limited_mode_) {
877        type_string += base::ASCIIToWide(" -- ");
878        type_string += l10n_util::GetStringUTF16(IDS_CONFLICTS_NOT_LOADED_YET);
879      }
880    }
881    data->SetString("type_description", type_string);
882    data->SetInteger("status", module->status);
883    data->SetString("location", module->location);
884    data->SetString("name", module->name);
885    data->SetString("product_name", module->product_name);
886    data->SetString("description", module->description);
887    data->SetString("version", module->version);
888    data->SetString("digital_signer", module->digital_signer);
889
890    if (!limited_mode_) {
891      // Figure out the possible resolution help string.
892      base::string16 actions;
893      base::string16 separator = base::ASCIIToWide(" ") +
894          l10n_util::GetStringUTF16(
895              IDS_CONFLICTS_CHECK_POSSIBLE_ACTION_SEPARATOR) +
896          base::ASCIIToWide(" ");
897
898      if (module->recommended_action & ModuleEnumerator::NONE) {
899        actions = l10n_util::GetStringUTF16(
900            IDS_CONFLICTS_CHECK_INVESTIGATING);
901      }
902      if (module->recommended_action & ModuleEnumerator::UNINSTALL) {
903        if (!actions.empty())
904          actions += separator;
905        actions = l10n_util::GetStringUTF16(
906            IDS_CONFLICTS_CHECK_POSSIBLE_ACTION_UNINSTALL);
907      }
908      if (module->recommended_action & ModuleEnumerator::UPDATE) {
909        if (!actions.empty())
910          actions += separator;
911        actions += l10n_util::GetStringUTF16(
912            IDS_CONFLICTS_CHECK_POSSIBLE_ACTION_UPDATE);
913      }
914      if (module->recommended_action & ModuleEnumerator::DISABLE) {
915        if (!actions.empty())
916          actions += separator;
917        actions += l10n_util::GetStringUTF16(
918            IDS_CONFLICTS_CHECK_POSSIBLE_ACTION_DISABLE);
919      }
920      base::string16 possible_resolution =
921          actions.empty() ? base::ASCIIToWide("")
922                          : l10n_util::GetStringUTF16(
923                                IDS_CONFLICTS_CHECK_POSSIBLE_ACTIONS) +
924          base::ASCIIToWide(" ") +
925          actions;
926      data->SetString("possibleResolution", possible_resolution);
927      data->SetString("help_url",
928                      ConstructHelpCenterUrl(*module).spec().c_str());
929    }
930
931    list->Append(data);
932  }
933
934  lock->Release();
935  return list;
936}
937
938GURL EnumerateModulesModel::GetFirstNotableConflict() {
939  lock->Acquire();
940  GURL url;
941
942  if (enumerated_modules_.empty()) {
943    lock->Release();
944    return GURL();
945  }
946
947  for (ModuleEnumerator::ModulesVector::const_iterator module =
948           enumerated_modules_.begin();
949       module != enumerated_modules_.end(); ++module) {
950    if (!(module->recommended_action & ModuleEnumerator::NOTIFY_USER))
951      continue;
952
953    url = ConstructHelpCenterUrl(*module);
954    DCHECK(url.is_valid());
955    break;
956  }
957
958  lock->Release();
959  return url;
960}
961
962
963EnumerateModulesModel::EnumerateModulesModel()
964    : limited_mode_(false),
965      scanning_(false),
966      conflict_notification_acknowledged_(false),
967      confirmed_bad_modules_detected_(0),
968      suspected_bad_modules_detected_(0),
969      modules_to_notify_about_(0) {
970  lock = new base::Lock();
971}
972
973EnumerateModulesModel::~EnumerateModulesModel() {
974  delete lock;
975}
976
977void EnumerateModulesModel::MaybePostScanningTask() {
978  static bool done = false;
979  if (!done) {
980    done = true;
981
982    const CommandLine& cmd_line = *CommandLine::ForCurrentProcess();
983    if (base::win::GetVersion() == base::win::VERSION_XP) {
984      check_modules_timer_.Start(FROM_HERE,
985          base::TimeDelta::FromMilliseconds(kModuleCheckDelayMs),
986          this, &EnumerateModulesModel::ScanNow);
987    }
988  }
989}
990
991void EnumerateModulesModel::DoneScanning() {
992  confirmed_bad_modules_detected_ = 0;
993  suspected_bad_modules_detected_ = 0;
994  modules_to_notify_about_ = 0;
995  for (ModuleEnumerator::ModulesVector::const_iterator module =
996       enumerated_modules_.begin();
997       module != enumerated_modules_.end(); ++module) {
998    if (module->status == ModuleEnumerator::CONFIRMED_BAD) {
999      ++confirmed_bad_modules_detected_;
1000      if (module->recommended_action & ModuleEnumerator::NOTIFY_USER)
1001        ++modules_to_notify_about_;
1002    } else if (module->status == ModuleEnumerator::SUSPECTED_BAD) {
1003      ++suspected_bad_modules_detected_;
1004      if (module->recommended_action & ModuleEnumerator::NOTIFY_USER)
1005        ++modules_to_notify_about_;
1006    }
1007  }
1008
1009  scanning_ = false;
1010  lock->Release();
1011
1012  UMA_HISTOGRAM_COUNTS_100("Conflicts.SuspectedBadModules",
1013                           suspected_bad_modules_detected_);
1014  UMA_HISTOGRAM_COUNTS_100("Conflicts.ConfirmedBadModules",
1015                           confirmed_bad_modules_detected_);
1016
1017  // Notifications are not available in limited mode.
1018  if (limited_mode_)
1019    return;
1020
1021  content::NotificationService::current()->Notify(
1022      chrome::NOTIFICATION_MODULE_LIST_ENUMERATED,
1023      content::Source<EnumerateModulesModel>(this),
1024      content::NotificationService::NoDetails());
1025}
1026
1027GURL EnumerateModulesModel::ConstructHelpCenterUrl(
1028    const ModuleEnumerator::Module& module) const {
1029  if (!(module.recommended_action & ModuleEnumerator::SEE_LINK) &&
1030      !(module.recommended_action & ModuleEnumerator::NOTIFY_USER))
1031    return GURL();
1032
1033  // Construct the needed hashes.
1034  std::string filename, location, description, signer;
1035  GenerateHash(base::WideToUTF8(module.name), &filename);
1036  GenerateHash(base::WideToUTF8(module.location), &location);
1037  GenerateHash(base::WideToUTF8(module.description), &description);
1038  GenerateHash(base::WideToUTF8(module.digital_signer), &signer);
1039
1040  base::string16 url =
1041      l10n_util::GetStringFUTF16(IDS_HELP_CENTER_VIEW_CONFLICTS,
1042          base::ASCIIToUTF16(filename), base::ASCIIToUTF16(location),
1043          base::ASCIIToUTF16(description), base::ASCIIToUTF16(signer));
1044  return GURL(base::UTF16ToUTF8(url));
1045}
1046